)���K��!�w(������C1�zpѹ/|�DB2"R������4�aS�/>�DHihW�U�K�cf����I�tT�(_��[r0���WBw2���W ����lj�eQ<����ߐx?���K��lA��>�lk�����@3�F�����������^�QH:��s#!�Z�*����G��HZ0W0���t�W��3���!})� � ��H�<���V�R��"� �T�<�Gpc�������V�d�4PZ�c��F�A�W�;�yG�8:�Ў�du�;���Ú�oog�a'����o�BM)��� �=�$�]#Pxs�����C�%��a����,F�M�?���>i��:N�y�����J���=�)[�( ���ftz���C�gb����ꁞ����'��/��L��!L��;�'�QO�*>:�d;��� ]�����f�~�<�2�B����r+n)!��I�g+���zv��0:Df��D `x?���&��Z�ٙq���deR��� =m�Ȥ���J�F��%����C&�[�l>[9��m���:8%h�.���� DA~#$|� 5�z,��V �� >B�M S��o:g>�G�Ekw�����m �������)i���~G���3r����D�"���C6H} ���G � }�ZY*l�r���V������W@z^���w��y��������5;V��,��/ɺ��"��CP� Y�3�/�ZM�pzeL)Z\3��V�AX �v�M�)�S� �n��5%�[����lQ�5��{��X���6wE�^�mt�+g��2���i�26�>��R!�S��j86�;H�uv"���� '&ԏ ��ɦM@���+{G7������ߟSo��Z�F�B�lo�r��?a���Ac������?��0��+����K�}/[S/���5gU�xwEA�$��+��q�`��������x���3�G��f�����ܣ���0�~i��0��V��Y�0�w��|���xyM �`B�ό���+���C�x5R��e:&�E(��ص%��sd��EX2��8+�XiF���i!���n$�F�2B��u/�C��+�����[���V��v�x�f�|'�R�v~��_�q��H�c�N� ��m���ҷ9�'hm�����DI:�l�(��.+�E)H��������!�y,�X&�|��JB[�����]¦�x[ ��au;��@�C���l~!���\J'��K��L���N����*_�e#7�1��~���&��Į���e�"Ҵ�*!��gH���~�.{)���8U�Zh�9� cf*��������TUª ��lr2��,�S|�')�@���(�YR9z�C�a߸ב.ɐ?��HOŕS0�=�md6�t��f�J���.�q�f�x;�6�g��c/�����(�R�AC*0�1j����T"(h�^��Y}L3�*,�j����.�Pt����ԕ�\d�-����8�����e���j5:K��E����bw��x� �� .G��I�X��.�+�vn��QN��� =8]���q\��%W�����-r�N�^ϲ%aj�`f(m҅����~��A5Jb��i.}����Du�_�I������F5�ɨ�#��%"Way����4��y�jz�J|cm*cm���Hf�k�a�T*���h������*��9��m�0��[�s `-�ʝO~�ػ��u����w ,H��WJ�Q�~P��_!Es������2,%2+��TRtPo�ތ%��,(�6u�������RO� ��Qp�v��1�W�ZE&]N�ra$߱h�Q�u�h�iN�3C����-@�?cOw��C���p�ѽ�p�\!e^�N�o��Ӆ3�)w�'��N^��+���H!H�y'�@�rL������f����F�>��/(�î|���%Ox�����g�$��ӡ��K�1%���o��B����7�ϒ��IZ���eW����tV�CGgAb��;٪���$���D��D�!*I�A��a)�*CчOjc����]|�VOa�r�b�78��$�x��7�e�g����+��?>I���q�=|U���%O���[��8�g�o�Ǣ��f�Z�I�@ �.�NrFʰ�jZf�yL���x�\���;Y2W�*��k)������X��/�g�(���,[��m�*�n�K�!P���0QtP/� [�/h���\*��XVl�����_G-���U瘧� �9M�FF^���Y�"<i�?��X�'��1��6�6���"X�N�o�|5�����3Zzk�%C�X�Ѵ҄u]K*�yW>Z��qgW �����,ѕ��!A�����`�̣}<EB�Fh[�4@��"X���0�g۟��cͥ�rf�`�0��_\c;�; #�Z��`8��HW7�b'��2oē�W��@��V�r˴Sl�.)(�v��3�f�rk��T�*�y�HRڡ-d���U ��ý0Փ�� J߆�����Ւ, ��;L3L��>=[��f l,_�5"���V�9M����N�Pd�9\�$��[��� O���8�����Z� ���W� �a�ƭa#���<��(9U�l5�1k*1s���j��CR��j�E`�B�y�!�~�U��z �mU1���E��o���q�)��j���$�i$ɒ}U�6�Z�<�=�[���� ���AC���_��G�8A�RE�I:�@�;iȷ)�V��]]J]�l*+p-@a���/A+�F���w���ӾqU@m�p�7=~T~)%Λ���91��IqFrl�3S�s�4��1iI�|�A~�>d��<ZxK�wvG��.h��5h���H�43!�j� ����-�D#�3��L�/��������8�:<�:����%]�)'��!��0��+��lх�Z�`-g���T-[|���Uw0���["�]���&�vY�㚆"��8# ><�ȠI�^)��?�ӣ�����5�@ͶPڥ\�xf,��lɳ��V�L�i���ՉѰ��i0��櫝�n�zJ;�Ubc9t���Ѐ=�$�D�2 �wԔ�=z�s�ϗ�������Nc�rNja_���u���@��P�h��z�������~�3��>)��&���}��D5ĕBzpVD�2��ϱ��6Q�h�,.����b͗�Gt+,%��;/;��?������}3���?i�LLcle��!y� ��i�b��U�8�ŕ����VdS�'h/������հv�v���B#�'�J�1��'�D5 �9�шB�,��h�s V�`�9�8�6@�NOB��0[�،M
Static task
static1
Behavioral task
behavioral1
Sample
2284f6662eee2c8e97ba5aaf38e6ab15f34b3a52f74544af375f45c352c340df.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2284f6662eee2c8e97ba5aaf38e6ab15f34b3a52f74544af375f45c352c340df.exe
Resource
win10v2004-20240226-en
General
-
Target
2284f6662eee2c8e97ba5aaf38e6ab15f34b3a52f74544af375f45c352c340df
-
Size
2.4MB
-
MD5
2f627e7527872bec6394ace838f1abe4
-
SHA1
cc2de2f97c7e0f7e85d2878c15354011d8d4e345
-
SHA256
2284f6662eee2c8e97ba5aaf38e6ab15f34b3a52f74544af375f45c352c340df
-
SHA512
c2a40fe8c61b92e3fa6b67e6bcc3d2db3b10c7e54f380836d44bde63889c0ccb83542efe60d3fdd7472025beb8c3b3e9dac7f8f80d91a639caba39ff5c166249
-
SSDEEP
49152:LJA65g2nuPE/3ljwfBQIMrkFfRJwaaDX85PKoc7K0wg9k24CqRBzZCDgb:JuPi3lYQZrkR5C+ic0wh24CGVC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2284f6662eee2c8e97ba5aaf38e6ab15f34b3a52f74544af375f45c352c340df
Files
-
2284f6662eee2c8e97ba5aaf38e6ab15f34b3a52f74544af375f45c352c340df.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 19KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE